Vulnerability analysis device, vulnerability analysis method, and vulnerability analysis program

Abstract

To provide a vulnerability analysis device capable of predicting tactics of a cyber attack utilizing vulnerability.SOLUTION: A vulnerability analysis device 1 comprises: a vulnerability information acquisition part 11 which acquires information related to Mitigation of vulnerability; a vector generation part 12 which generates a first vector based upon similarities between the information and a plurality of descriptions of Mitigation in a predetermined database as elements; a Technique analysis part 13 which generates a second vector based upon similarities between the first vector and vectors representing a correspondence to a plurality of Mitigations of a plurality of Techniques; a Tactic analysis part 14 which calculates similarities between the second vector and vectors representing a correspondence to a plurality of Techniques of a plurality of Tactics; and a result output part 15 which outputs the evaluation results of Tactics corresponding to vulnerability represented by the calculated similarities.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] This invention relates to the collection and analysis of cyber threat information. [Background technology]

[0002] In recent years, with the rapid increase in cyberattacks, the need for early attack prediction and detection has become increasingly important. Furthermore, cyber threats require a societal response that involves sharing information rather than individual responses. This has led to the development of common formats for vulnerability information and the publication of databases, as well as the dissemination of various types of information through company websites, social media, blogs, and other channels.

[0003] Common Vulnerabilities and Exposures (CVE) IDs, used to identify vulnerabilities in publicly available software, are widely used by security professionals and engineers as a first step in security measures. For example, the National Vulnerability Database (NVD) managed by NIST (see Non-Patent Document 1) contains information on each vulnerability, including its CVE ID, details of the vulnerability, risk level, and related products. Using this CVE ID as a key, it is possible to link blogs and social media, as well as public databases such as CWE (Common Weakness Enumeration) (see Non-Patent Document 2) and CAPEC (Common Attack Pattern Enumeration and Classification) (see Non-Patent Document 3), and threat intelligence platforms such as OTX (Open Threat Exchange), enabling data enrichment for each vulnerability. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] NVD, Internet,<https: / / nvd.nist.gov / > [Non-Patent Document 2] CWE, Internet,<https: / / cwe.mitre.org / > [Non-Patent Document 3] CAPEC, Internet,<https: / / capec.mitre.org / > [Non-Patent Document 4] ATT&CK, Internet,<https: / / attack.mitre.org / > [Non-Patent Document 5] Aditya Kuppa et al., "Linking CVE's to MITER ATT&CK Techniques", Proceedings of the 16th International Conference on Availability, Reliability and Security (ARES 2021). [Overview of the project] [Problems that the invention aims to solve]

[0005] However, not all databases and documents such as blogs necessarily include CVE IDs. In particular, MITER's ATT&CK (see Non-Patent Document 4) is a database that compiles structured attack methods and is highly valuable, but it cannot be linked using CVE IDs as a key. There are studies aimed at this linking, and for example, Non-Patent Document 5 proposes a method for estimating the Technique used for each vulnerability. This method aims to directly estimate the Technique by using a large amount of data linked to vulnerabilities, including Mitigation information, and also uses data that actually links vulnerabilities and Techniques. However, in many organizations, there are few cases where a large amount of data is held, and even just scrutinizing the data linked to vulnerabilities is costly.

[0006] Furthermore, for any discovered vulnerabilities, it is desirable to link this information with the techniques used to exploit them, as well as the tactics employed to achieve those techniques, in order to assess the urgency of addressing the vulnerability.

[0007] The present invention aims to provide a vulnerability analysis device, a vulnerability analysis method, and a vulnerability analysis program that can predict the tactic of cyberattacks that exploit vulnerabilities. [Means for solving the problem]

[0008] The first vulnerability analysis device according to the present invention comprises: a vulnerability information acquisition unit that acquires information on vulnerability mitigations; a vector generation unit that generates a first vector whose elements are the similarity between the information on the mitigations and each of the descriptions of a plurality of mitigations in a predetermined database; a technique analysis unit that generates a second vector whose elements are the similarity between the first vector and each of the vectors representing the correspondence between each of the plurality of techniques defined in the predetermined database and the plurality of mitigations; a tactic analysis unit that calculates the similarity between the second vector and each of the vectors representing the correspondence between each of the plurality of tactics defined in the predetermined database and the plurality of techniques; and a result output unit that outputs an evaluation result of a tactic corresponding to the vulnerability, indicated by the similarity calculated by the tactic analysis unit.

[0009] The second vulnerability analysis device according to the present invention comprises: a vulnerability information acquisition unit that acquires information regarding the detection of a vulnerability; a vector generation unit that generates a third vector whose elements are the similarity between the information regarding the detection and each of the descriptions of a plurality of detections in a predetermined database; a technique analysis unit that generates a fourth vector whose elements are the similarity between the third vector and each of the vectors representing the correspondence between each of the plurality of techniques defined in the predetermined database and the plurality of detections; a tactic analysis unit that calculates the similarity between the fourth vector and each of the vectors representing the correspondence between each of the plurality of tactics defined in the predetermined database and the plurality of techniques; and a result output unit that outputs an evaluation result of a tactic corresponding to the vulnerability indicated by the similarity calculated by the tactic analysis unit.

[0010] In the first vulnerability analysis device, the vulnerability information acquisition unit further acquires information regarding detections, the vector generation unit further generates a third vector whose elements are the similarity between the information regarding the detections and each of the descriptions of multiple detections in the predetermined database, and the technique analysis unit further generates a fourth vector whose elements are the similarity between the third vector and each of the vectors representing the correspondence between each of the multiple techniques defined in the predetermined database and the multiple detections, and the second vector may be updated by taking a weighted average of the second vector and the fourth vector.

[0011] In the first vulnerability analysis device, the vector generation unit may further generate a fifth vector whose elements are the similarity between the information regarding the mitigation and each of the descriptions of the mitigation for the plurality of techniques in the predetermined database, and the technique analysis unit may update the second vector by weighting the second vector, the fourth vector, and the fifth vector.

[0012] A first vulnerability analysis method according to the present invention is performed by a computer, comprising: a vulnerability information acquisition step of acquiring information about vulnerability mitigations; a vector generation step of generating a first vector whose elements are the similarity between the information about the mitigations and each of the descriptions of a plurality of mitigations in a predetermined database; a technique analysis step of generating a second vector whose elements are the similarity between the first vector and each of the vectors representing the correspondence between each of the plurality of techniques defined in the predetermined database and the plurality of mitigations; a tactic analysis step of calculating the similarity between the second vector and each of the vectors representing the correspondence between each of the plurality of tactics defined in the predetermined database and the plurality of techniques; and a result output step of outputting an evaluation result of a tactic corresponding to the vulnerability indicated by the similarity calculated in the tactic analysis step.

[0013] A second vulnerability analysis method according to the present invention is performed by a computer, comprising: a vulnerability information acquisition step of acquiring information about the detection of a vulnerability; a vector generation step of generating a third vector whose elements are the similarity between the information about the detection and each of the descriptions of a plurality of detections in a predetermined database; a technique analysis step of generating a fourth vector whose elements are the similarity between the third vector and each of the vectors representing the correspondence between each of the plurality of techniques defined in the predetermined database and the plurality of detections; a tactic analysis step of calculating the similarity between the fourth vector and each of the vectors representing the correspondence between each of the plurality of tactics defined in the predetermined database and the plurality of techniques; and a result output step of outputting an evaluation result of a tactic corresponding to the vulnerability, indicated by the similarity calculated in the tactic analysis step.

[0014] The vulnerability analysis program according to the present invention is for causing a computer to function as the first or second vulnerability analysis device. [Effects of the Invention]

[0015] According to the present invention, it is possible to predict the tactic of cyberattacks that exploit vulnerabilities. [Brief explanation of the drawing]

[0016] [Figure 1] This block diagram shows the functional configuration of the vulnerability analysis device in the first embodiment. [Figure 2] This is a flowchart showing the procedure for the vulnerability analysis method in the first embodiment. [Figure 3] This is a flowchart showing the procedure for the vulnerability analysis method in the second embodiment. [Figure 4] This is a flowchart showing the procedure for the vulnerability analysis method in the third embodiment. [Figure 5] This is a flowchart showing the procedure for the vulnerability analysis method in the fourth embodiment. [Modes for carrying out the invention]

[0017] The following describes embodiments of the present invention. The vulnerability analysis method of this embodiment focuses on Mitigation or Detection (detection method), which are relatively easily obtainable information regarding CVE IDs, and utilizes a predetermined database in which similar information is linked to Technique, and Technique is linked to Tactic. Here, we use ATT&CK as an example of a database, but it is not limited to this; any database that stores similar information will suffice.

[0018] At ATT&CK, Link from Mitigation to Technique, Link from Tactic to Technique, Link from Detection to Technique, Link from Technique to Mitigation. Link from Technique to Detection, A section has been established, and the correspondence is described.

[0019] [First Embodiment] The vulnerability analysis device 1 of the first embodiment estimates the Technique based on the similarity between the Mitigation information obtained about the vulnerability and the Mitigation description in the database (ATT&CK), and further determines the Tactic, thereby enabling the assessment of the urgency of countermeasures against this vulnerability.

[0020] Figure 1 is a block diagram showing the functional configuration of the vulnerability analysis device 1 in this embodiment. The vulnerability analysis device 1 is an information processing device equipped with a control unit 10 and a storage unit 20, as well as various input / output interfaces.

[0021] The control unit 10 is the part that controls the entire vulnerability analysis device 1, and realizes each function in this embodiment by appropriately reading and executing various programs stored in the memory unit 20. The control unit 10 may be a CPU.

[0022] The memory unit 20 is a storage area for various programs and data necessary for the hardware group to function as a vulnerability analysis device 1, and may be ROM, RAM, flash memory, or a hard disk drive (HDD).

[0023] The control unit 10 functions as a vulnerability information acquisition unit 11, a vector generation unit 12, a technique analysis unit 13, a tactic analysis unit 14, and a result output unit 15 by executing the software (vulnerability analysis program) stored in the memory unit 20.

[0024] The vulnerability information acquisition unit 11 acquires descriptions related to vulnerability mitigation. Information regarding vulnerability mitigation may be extracted from documents such as blogs or various social media services, and may also be extracted from public databases, for example, CWE ID information included in NVD, or advisory information.

[0025] The vector generation unit 12 determines similarity between information on mitigation acquired for a vulnerability by the vulnerability information acquisition unit 11 and mitigation descriptions in a predetermined database (ATT&CK), and represents each vulnerability as a first vector.

[0026] The similarity determination can be implemented by general natural language processing such as Word2vec, Doc2vec, and BERT. Accordingly, information c regarding mitigation for vulnerability i i is compared with each mitigation description m in ATT&CK j (of p types), and the first vector having the similarity as an element CVE i Mit =(d1(c i ,m1),…,d1(c i ,m p )) =(mit i1 ,…,mit ip ) can be used to represent vulnerability i. Note that d num (·) represents an appropriate distance function; Euclidean distance, cosine distance, or the like can be used, and the value is normalized to a value between 0 and 1 (probability).

[0027] The technique analysis unit 13 generates a second vector whose elements are similarities between the first vector representing a vulnerability generated by the vector generation unit 12 and respective vectors representing correspondences between each of a plurality of techniques defined in the database (ATT&CK) and a plurality of mitigations for the techniques.

[0028] Here, each of the multiple Mitigations described in ATT&CK is associated with a corresponding Technique (q types), and the j-th Technique is: Tec j Mit =( tm j1 ,…,tm jp )∈{0,1} p It can be expressed using one-hot coding as (j=1,…,q). For example, for the j-th Technique, if the 1st, 2nd, and 4th Mitigations are valid, then Tec j Mit This can be expressed as (1,1,0,1,0,…,0). This allows vulnerabilities and techniques to be represented as vectors in the same space through mitigation.

[0029] Therefore, the Technique Analysis Unit 13 performed CVE analysis on each i and j. i Mit and Tec j Mit Similarity d2(CVE) i Mit ,Tec j Mit Using ), the second vector CVE i Tec =(d2(CVE i Mit ,Tec1 Mit ),…,d2(CVE i Mit ,Tec q Mit ))=(tec i1 ,…,tec iq ) Calculate.

[0030] The Tactic analysis unit 14 generates a second vector CVE representing the vulnerability generated by the Technique analysis unit 13. i Tec Then, the similarity is calculated between each vector representing the correspondence between each of the multiple techniques defined in the database (ATT&CK) for each of the multiple tactics.

[0031] Here, each of the multiple Techniques described in ATT&CK is associated with a corresponding Tactic (r type), and the h-th Tactic is: Tac h Tec =(tt h1 ,…,tt hq )∈{0,1} q It can be represented using one-hot coding as follows: (h=1,…,r) This allows vulnerabilities and tactics to be represented as vectors in the same space via technique.

[0032] Therefore, the Tactic analysis unit 14 performs CVE for each i and h. i Tec and Tac h Tec Similarity d3(CVE) i Tec Tac h Tec ) using CVE i Tac =(d3(CVE i Tec ,Tac1 Tec ),…,d3(CVE i Tec Tac r Tec )) Calculate. Generated vector CVE i Tac The element represents the similarity (distance) between vulnerability i and each Tactic, thus allowing us to evaluate which Tactic exploits each vulnerability.

[0033] The result output unit 15 outputs the evaluation result of the Tactic corresponding to the vulnerability indicated by the similarity calculated by the Tactic analysis unit 14.

[0034] Figure 2 is a flowchart showing the procedure for vulnerability analysis in this embodiment. In step S1, the vulnerability information acquisition unit 11 acquires information regarding mitigation for the vulnerability (CVE) to be analyzed.

[0035] In step S2, the vector generation unit 12 generates a first vector (CVE) representing vulnerabilities (CVEs) based on the similarity between the information on Mitigations obtained in step S1 and the descriptions of each of the p Mitigations explained in ATT&CK. Mit ∈R p ) generates.

[0036] In step S3, the Technique analysis unit 13 analyzes the first vector (CVE) generated in step S2. Mit ) and q one-hot vectors (Tec) representing q Techniques as Mitigations based on the link structure in ATT&CK. Mit ∈{0,1} p Based on the similarity to each, a second vector (CVE) is generated representing the vulnerability (CVE) in terms of Technique. Tec ∈R q ) generates.

[0037] In step S4, the Tactic analysis unit 14 analyzes the second vector (CVE) generated in step S3. Tec ) and r one-hot vectors (Tac) where r tactics are represented by Technique based on the link structure in ATT&CK. Tec ∈{0,1} q Based on the similarity to each, a vector representing vulnerabilities (CVEs) in Tactic form (CVE) Tac ∈R r ) generates.

[0038] In step S5, the result output unit 15 outputs the vector (CVE) generated in step S4. Tac Each element of the above is output as an evaluation value, which is the result of estimating which tactic the vulnerability (CVE) will be exploited by.

[0039] [Second Embodiment] In the first embodiment, a method for estimating Tactic based on information regarding Mitigation for each vulnerability was shown, but in the second embodiment, Detection is used instead of Mitigation. In other words, the vulnerability analysis device 1 estimates the technique based on the similarity between the detection information obtained about the vulnerability and the detection description in the database (ATT&CK), and then determines the tactic.

[0040] Specifically, the configuration of the vulnerability analysis device 1 is the same as in the first embodiment, but the functions of the vulnerability information acquisition unit 11, the vector generation unit 12, and the technique analysis unit 13 are different, with "Mitigation" being replaced with "Detection" in each case.

[0041] In other words, the vulnerability information acquisition unit 11 acquires information about Detection for each vulnerability, and the vector generation unit 12 generates a third vector using the similarity between this information and the descriptions of each of the multiple Detections defined in ATT&CK as elements. Furthermore, the Technique analysis unit 13 generates a fourth vector using the similarity between this third vector and each vector representing the correspondence between each of the multiple detections defined in ATT&CK as elements.

[0042] This fourth vector is the second vector CVE in the first embodiment. i Tec Corresponding to this, the Tactic analysis unit 14 performs CVE in the same manner as in the first embodiment. i Tac The output unit 15 generates the result and outputs the evaluation result.

[0043] Figure 3 is a flowchart showing the procedure for the vulnerability analysis method in this embodiment. In step S11, the vulnerability information acquisition unit 11 acquires information related to Detection for a vulnerability (CVE) to be analyzed.

[0044] In step S12, the vector generation unit 12 generates a third vector representing the vulnerability (CVE) with Detection (CVE Det ∈R s ) based on the similarity between the information related to Detection acquired in step S11 and the description of each of s Detections described in ATT&CK.

[0045] In step S13, the Technique analysis unit 13 generates a fourth vector representing the vulnerability (CVE) with Technique (CVE Det ) and q one-hot vectors representing q Techniques with Detection based on the link structure in ATT&CK (Tec Det ∈{0,1} s ) based on the similarity with each of the vectors, the fourth vector representing the vulnerability (CVE) with Technique (CVE Tec ∈R q ) is generated.

[0046] In step S14, the Tactic analysis unit 14 uses the fourth vector generated in step S13 (CVE Tec ) and r one-hot vectors representing r Tactics with Technique based on the link structure in ATT&CK (Tac Tec ∈{0,1} q ) based on the similarity with each of the vectors, a vector representing the vulnerability (CVE) with Tactic (CVE Tac ∈R r ) is generated.

[0047] In step S15, the result output unit 15 outputs each element of the vector generated in step S14 (CVE Tac ) as an evaluation value which is a result estimating which Tactic the vulnerability (CVE) is used in.

[0048] [Third Embodiment] In the third embodiment, each of the vulnerability information acquisition unit 11, the vector generation unit 12, and the Technique analysis unit 13 has the functions of both the first embodiment and the second embodiment. That is, based on the descriptions of Mitigation and Detection for each vulnerability, the second vector and the fourth vector representing a vulnerability (CVE) in Technique are generated according to the respective procedures of the first embodiment and the second embodiment.

[0049] Further, the Technique analysis unit 13 updates the second vector by performing weighted averaging or simply averaging on the second vector and the fourth vector. The Tactic analysis unit 14, in the same manner as in the first embodiment, uses the updated second vector CVE i Tec and one-hot vector Tac h Tec to generate a CVE with the similarity therebetween as an element i Tac and the result output unit 15 outputs the evaluation result.

[0050] FIG. 4 is a flowchart illustrating the procedure of the vulnerability analysis method according to the present embodiment. In step S21, the vulnerability information acquisition unit 11 acquires information related to Mitigation for the vulnerability to be analyzed. In step S22, the vulnerability information acquisition unit 11 acquires information related to Detection for the vulnerability to be analyzed.

[0051] In step S23, the vector generation unit 12 obtains the first vector (CVE Mit ∈R p ) based on the similarity between the information related to Mitigation acquired in step S21 and the description of each of the p Mitigations described in ATT&CK. In step S24, the vector generation unit 12 generates a third vector (CVE) based on the similarity between the information about the Detection obtained in step S22 and the descriptions of each of the s Detections described in ATT&CK. Det ∈R s ) generates.

[0052] In step S25, the Technique analysis unit 13 analyzes the first vector (CVE) generated in step S23. Mit ) and the one-hot vector of q Techniques based on the link structure in ATT&CK (Tec Mit ∈{0,1} p ) From the similarity with each, the second vector (CVE) is derived. Tec ∈R q ) generates. In step S26, the Technique analysis unit 13 analyzes the third vector (CVE) generated in step S24. Det ) and the one-hot vector of q Techniques (Tec Det ∈{0,1} s ) Based on the similarity to each, the fourth vector (CVE) Tec ∈R q ) generates.

[0053] In step S27, the Technique analysis unit 13 updates the second vector by normalizing the second vector generated in step S25 and the fourth vector generated in step S26, and then performing a weighted average or simple average.

[0054] In step S28, the Tactic analysis unit 14 analyzes the second vector (CVE) updated in step S27. Tec ) and r one-hot vectors (Tac) based on the link structure in ATT&CK. Tec ∈{0,1} q ) From the similarity to each, a vector (CVE) is generated. Tac ∈R r ) generates.

[0055] In step S29, the result output unit 15 outputs the vector (CVE) generated in step S28. Tac ∈R r Each element of the above is output as an estimated value that predicts which tactic will exploit the vulnerability (CVE).

[0056] [Fourth Embodiment] In ATT&CK, each mitigation is outlined (p mitigations), and each technique is described in detail (q techniques). Therefore, the vulnerability analysis device 1 of the fourth embodiment directly estimates the Technique from the vulnerability using the Mitigation description written for each Technique.

[0057] In other words, the vector generation unit 12 generates a fifth vector CVE whose elements are the similarity between the Mitigation information acquired by the vulnerability information acquisition unit 11 and the descriptions of Mitigation for each of the q Techniques in a predetermined database (ATT&CK). Tec ∈R q Further generation is performed.

[0058] This fifth vector (CVE Tec Since the second vector can be treated in the same way as the second and fourth vectors mentioned above, the Technique analysis unit 13 updates the second vector by weighting the second, fourth, and fifth vectors, or simply averaging them.

[0059] The Tactic analysis unit 14, in the same manner as in the first to third embodiments, updates the second vector CVE i Tec and one-hot vector Tac h Tec CVE with similarity as an element i Tac The output unit 15 generates the result and outputs the evaluation result.

[0060] Figure 5 is a flowchart showing the procedure for the vulnerability analysis method in this embodiment. Steps 31 to S36 are the same procedure as in the third embodiment (Figure 4).

[0061] In step S37, the vector generation unit 12 generates a fifth vector (CVE) based on the similarity between the Mitigation information obtained in step S31 and the descriptions of each of the q Techniques' Mitigation described in ATT&CK. Tec ∈R q ) generates.

[0062] In step S38, the Technique analysis unit 13 updates the second vector by normalizing the second vector generated in step S35, the fourth vector generated in step S36, and the fifth vector generated in step S37, and then performing a weighted average or simple average.

[0063] In step S39, the Tactic analysis unit 14 analyzes the second vector (CVE) updated in step S38. Tec ) and r one-hot vectors (Tac) based on the link structure in ATT&CK. Tec ∈{0,1} q ) From the similarity to each, a vector (CVE) is generated. Tac ∈R r ) generates.

[0064] In step S40, the result output unit 15 outputs the vector (CVE) generated in step S39. Tac ∈R r Each element of the above is output as an estimated value that predicts which tactic will exploit the vulnerability (CVE).

[0065] While embodiments 1 to 4 described above explained the processing of the i-th vulnerability (CVE), multiple vulnerabilities can also be processed simultaneously using a matrix, as follows. Here, we illustrate a procedure for processing k vulnerabilities based on mitigation information.

[0066] First, in ATT&CK, p Mitigations, q Techniques, and r Tactics are interconnected, and from this link structure, we can obtain the following matrices: (1) representing Mitigations in terms of Techniques, (2) representing Techniques in terms of Mitigations, and (3) representing Tactics in terms of Techniques.

number

[0067] Here, the k vulnerabilities (CVEs) are represented by the following matrix, based on probabilities derived from their similarity to each of the p mitigation descriptions in ATT&CK.

number

[0068] (2) and (4) are similar, and a matrix is ​​formed representing vulnerabilities (CVEs) by Technique.

number

number

[0069] According to the above embodiment, the vulnerability analysis device 1 generates a vector with similarity as an element by comparing the Mitigation or Detection information for each vulnerability with the description in a predetermined database (ATT&CK). The vulnerability analysis device 1 then generates a vector representing the vulnerability in terms of Technique, using the similarity between this vector and the one-hot vector of each Technique obtained from the link structure in the database as elements. Furthermore, it generates a vector representing the vulnerability in terms of Tactic, using the similarity between this vector and the one-hot vector of each Tactic as elements. This allows the vulnerability analysis device 1 to predict the tactic of cyberattacks that exploit vulnerabilities. As a result, the urgency of addressing the vulnerabilities can be assessed.

[0070] Furthermore, vulnerability analysis device 1 can also comprehensively predict tactic using both mitigation and detection information. An increase in the amount of information available for similarity calculation is expected to improve prediction accuracy.

[0071] Furthermore, if a mitigation description exists for each technique in a designated database (ATT&CK), the vulnerability analysis device 1 can directly estimate the technique from the vulnerability based on the similarity of the mitigations. This increases the amount of estimated information, which is expected to further improve prediction accuracy.

[0072] Furthermore, this will enable us to appropriately assess the urgency of countermeasures against discovered vulnerabilities, thereby contributing to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs): "Build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0073] Although embodiments of the present invention have been described above, the present invention is not limited to the embodiments described above. Furthermore, the effects described in the embodiments described above are merely a list of the most preferred effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0074] The vulnerability analysis method performed by vulnerability analysis device 1 is implemented by software. When implemented by software, the programs constituting this software are installed on an information processing device (computer). These programs may be distributed to users by being recorded on removable media such as a CD-ROM, or by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a web service via a network without being downloaded. [Explanation of symbols]

[0075] 1 Vulnerability analysis device 10 Control Unit 11 Vulnerability information acquisition department 12 Vector generation unit 13 Technique Analysis Department 14 Tactic Analysis Department 15 Result Output Section 20 Memory section

Claims

1. A vulnerability information acquisition unit that obtains information regarding vulnerability mitigation, A vector generation unit generates a first vector whose elements are the similarity between the information about the aforementioned Mitigation and each of the descriptions of multiple Mitigations in a predetermined database. A Technique analysis unit generates a second vector whose elements are the similarity between the first vector and each vector representing the correspondence between each of the multiple Techniques defined in the predetermined database and the multiple Mitigations, A Tactic analysis unit calculates the similarity between the second vector and each vector representing the correspondence between each of the multiple Tactics defined in the predetermined database and the multiple Techniques, A vulnerability analysis device comprising: a result output unit that outputs a Tactic evaluation result corresponding to the vulnerability indicated by the similarity calculated by the Tactic analysis unit; and a result output unit that outputs a Tactic evaluation result corresponding to the vulnerability.

2. A vulnerability information acquisition unit that obtains information regarding vulnerability detection, A vector generation unit generates a third vector whose elements are the similarity between the information about the aforementioned Detection and each of the descriptions of multiple Detections in a predetermined database. A Technique analysis unit generates a fourth vector whose elements are the similarity between the third vector and each vector representing the correspondence between each of the multiple Techniques defined in the predetermined database and the multiple Detections, A Tactic analysis unit calculates the similarity between the fourth vector and each vector representing the correspondence between each of the multiple Tactics defined in the predetermined database and the multiple Techniques, A vulnerability analysis device comprising: a result output unit that outputs a Tactic evaluation result corresponding to the vulnerability indicated by the similarity calculated by the Tactic analysis unit; and a result output unit that outputs a Tactic evaluation result corresponding to the vulnerability.

3. The vulnerability information acquisition unit further acquires information related to Detection, The vector generation unit further generates a third vector whose elements are the similarity between the information about the Detection and each of the descriptions of the multiple Detections in the predetermined database. The aforementioned Technique analysis unit is A fourth vector is further generated, the elements of which are the similarity between the third vector and each vector representing the correspondence between each of the multiple Techniques defined in the predetermined database and the multiple Detections. The vulnerability analysis device according to claim 1, wherein the second vector is updated by taking a weighted average of the second vector and the fourth vector.

4. The vector generation unit further generates a fifth vector whose elements are the similarity between the information regarding the Mitigation and each of the descriptions of the Mitigation for the plurality of Techniques in the predetermined database. The vulnerability analysis device according to claim 3, wherein the Technique analysis unit updates the second vector by weighting the second vector, the fourth vector, and the fifth vector.

5. The vulnerability information acquisition step involves obtaining information about vulnerability mitigation, A vector generation step of generating a first vector whose elements are the similarity between the information about the aforementioned Mitigation and each of the descriptions of multiple Mitigations in a predetermined database, A Technique analysis step that generates a second vector whose elements are the similarity between the first vector and each vector representing the correspondence between each of the plurality of Techniques defined in the predetermined database and the plurality of Mitigations, A tactic analysis step of calculating the similarity between the second vector and each vector representing the correspondence between each of the plurality of Tactics defined in the predetermined database and the plurality of Tactics, A vulnerability analysis method performed by a computer, comprising: a result output step that outputs an evaluation result of the Tactic corresponding to the vulnerability, indicated by the similarity calculated in the Tactic analysis step; and a result output step that outputs an evaluation result of the Tactic corresponding to the vulnerability.

6. The vulnerability information acquisition step involves obtaining information regarding the detection of vulnerabilities, A vector generation step of generating a third vector whose elements are the similarity between the information about the aforementioned Detection and each of the descriptions of multiple Detections in a predetermined database, A Technique analysis step that generates a fourth vector whose elements are the similarity between the third vector and each vector representing the correspondence between each of the plurality of Techniques defined in the predetermined database and the plurality of Detections, A tactic analysis step that calculates the similarity between the fourth vector and each vector representing the correspondence between each of the plurality of Tactics defined in the predetermined database and the plurality of Tactics, A vulnerability analysis method performed by a computer, comprising: a result output step that outputs an evaluation result of the Tactic corresponding to the vulnerability, indicated by the similarity calculated in the Tactic analysis step; and a result output step that outputs an evaluation result of the Tactic corresponding to the vulnerability.

7. A vulnerability analysis program for causing a computer to function as a vulnerability analysis device according to any one of claims 1 to 4.

Images